agentic-engineering-harness 0.8.6 → 0.8.8

package/dist/releases/release-1790879524733-14883-031f8c92/delivery/finalize.js

@@ -1,181 +0,0 @@
-import { computeWorktreeDigest } from "../core/git.js";
-import { handoffTask, githubRequest, loadDeliveryRecord, resolveGithubToken } from "./handoff.js";
-import { runExecutable } from "../utils/process.js";
-import { verifySupplyChainGate } from "../provenance/generate.js";
-import { controllerEpochFromEnvironment, currentOperationContext, loadOperation, resolveOperationStateRoot } from "../operations/state.js";
-import { reconcileToolAction } from "../security/actionReconciliation.js";
-import { executeGatedAction } from "../security/gatedAction.js";
-import { controllerActorId } from "../security/toolActionGate.js";
-import { assertWorkspaceMatchesCandidate } from "../candidates/identity.js";
-import { requireAcceptedCurrentOracleV1 } from "../architecture/acceptanceOracle.js";
-export async function finalizeAcceptedIssue(root, config, contract, options = {}) {
-    const candidate = options.candidate;
-    const github = config.delivery?.github;
-    if (!contract.issue || contract.issue.provider !== "github")
-        return skipped("Task is not issue-derived.", candidate);
-    const handoffRequested = config.workflow?.issueIntake?.autoHandoff !== false;
-    const finalizationRequested = github?.finalizeOnAcceptance === true;
-    if (!github?.enabled || (!handoffRequested && !finalizationRequested))
-        return skipped("GitHub delivery and issue handoff are not enabled.", candidate);
-    const operationContext = currentOperationContext();
-    const operationId = operationContext.id;
-    const controllerEpoch = controllerEpochFromEnvironment();
-    if (!operationId || controllerEpoch === undefined)
-        throw new Error("DELIVERY_AUTHORITY_REQUIRED: accepted delivery must run inside a managed operation with a fenced controller epoch.");
-    const operation = await loadOperation(resolveOperationStateRoot(root), operationId);
-    const boundCandidate = candidate ?? operation.candidateRevision;
-    if (!boundCandidate || !operation.candidateRevision || boundCandidate.identityDigest !== operation.candidateRevision.identityDigest) {
-        throw new Error("DELIVERY_AUTHORITY_REQUIRED: delivery requires the operation's current CandidateRevision.");
-    }
-    await requireAcceptedCurrentOracleV1(resolveOperationStateRoot(root), operation, boundCandidate);
-    await assertWorkspaceMatchesCandidate(root, boundCandidate, operation.candidateRevision);
-    const initialRecord = await loadDeliveryRecord(root, config, contract.task.id);
-    if ((handoffRequested || finalizationRequested) && (!initialRecord?.github?.issueNumber || !initialRecord.github.branch)) {
-        // The controller already provisioned the candidate's internal execution
-        // workspace. Handoff here may create public GitHub resources only after
-        // current acceptance and never provisions a second execution workspace.
-        await handoffTask(root, config, contract.task.id, { createWorkspace: false });
-    }
-    if (!finalizationRequested) {
-        return handoffRequested
-            ? { status: "HANDOFF_ONLY", humanRequired: false, committed: false, pushed: false, candidate: boundCandidate, message: `Accepted issue task ${contract.task.id} has completed its requested handoff.` }
-            : skipped("GitHub finalization and issue handoff are not enabled.", candidate);
-    }
-    const authority = { kind: "controller-authority", operationId, controllerEpoch };
-    const actor = controllerActorId(operationId);
-    const supplyChain = await verifySupplyChainGate(root, config, { candidate: boundCandidate, artifactPath: config.provenance?.artifact ?? "" });
-    if (!supplyChain.ok)
-        throw new Error(`SUPPLY_CHAIN_BLOCKED: ${supplyChain.failures.join("; ")}`);
-    const record = await loadDeliveryRecord(root, config, contract.task.id);
-    const branch = record?.github?.branch;
-    if (!branch)
-        throw new Error(`BLOCKED_EXTERNAL: accepted issue task ${contract.task.id} has no issue-linked delivery branch to finalize.`);
-    const repository = record.github?.repository ?? contract.issue.repository;
-    const base = contract.git?.originatingBranch ?? contract.git?.baseRef ?? config.validation?.baseRef ?? "main";
-    const status = await runExecutable("git", ["status", "--porcelain"], { cwd: root, timeoutMs: 30_000 });
-    if (status.exitCode !== 0)
-        throw new Error(`SYSTEM_FAILURE: cannot inspect final Git state: ${status.stderr || status.stdout}`);
-    let committed = false;
-    let commitSha;
-    if (status.stdout.trim()) {
-        const commitMessage = `${contract.task.id}: ${contract.task.title}`;
-        const contentDigest = await computeWorktreeDigest(root);
-        await assertWorkspaceMatchesCandidate(root, boundCandidate, operation.candidateRevision);
-        const commitGate = await executeGatedAction({
-            root,
-            request: { root, operationId, participantId: actor, candidate: boundCandidate, actionKey: `delivery:${contract.task.id}:commit`, action: "git.commit", payload: { taskId: contract.task.id, message: commitMessage, contentDigest }, authority },
-            execute: async () => {
-                const add = await runExecutable("git", ["add", "-A"], { cwd: root, timeoutMs: 60_000 });
-                if (add.exitCode !== 0)
-                    return { outcome: "FAILED", evidence: { step: "add", exitCode: add.exitCode, stderr: add.stderr.slice(-2000) } };
-                try {
-                    await assertWorkspaceMatchesCandidate(root, boundCandidate, operation.candidateRevision);
-                }
-                catch (error) {
-                    return { outcome: "FAILED", evidence: { step: "candidate-identity", message: String(error) } };
-                }
-                const commit = await commitWithConfiguredOrHarnessIdentity(root, commitMessage);
-                return { outcome: commit.exitCode === 0 ? "SUCCEEDED" : "FAILED", evidence: { step: "commit", exitCode: commit.exitCode, stderr: commit.stderr.slice(-2000) } };
-            },
-            reconcile: (intent) => reconcileToolAction(root, intent, { taskId: contract.task.id, message: commitMessage })
-        });
-        assertDeliveryGateProgress(commitGate, "git.commit");
-        if (commitGate.receipt?.outcome === "FAILED")
-            throw new Error(`SYSTEM_FAILURE: git commit failed during deterministic finalization: ${commitGate.detail}`);
-        committed = true;
-        commitSha = await revParse(root, "HEAD");
-    }
-    else
-        commitSha = await revParse(root, "HEAD");
-    await assertWorkspaceMatchesCandidate(root, boundCandidate, operation.candidateRevision);
-    const baseCommit = await revParse(root, `${base}^{commit}`);
-    const ahead = await runExecutable("git", ["rev-list", "--count", `${baseCommit}..HEAD`], { cwd: root, timeoutMs: 30_000 });
-    if (ahead.exitCode !== 0)
-        throw new Error(`SYSTEM_FAILURE: cannot determine whether ${branch} contains deliverable commits: ${ahead.stderr || ahead.stdout}`);
-    if (Number(ahead.stdout.trim() || "0") === 0)
-        return { status: "NO_CHANGES", humanRequired: false, committed, commitSha, pushed: false, candidate, message: `No commits differ from ${base}; no pull request is required.` };
-    const pushGate = await executeGatedAction({
-        root,
-        request: { root, operationId, participantId: actor, candidate: boundCandidate, actionKey: `delivery:${contract.task.id}:push`, action: "git.push", payload: { remote: "origin", ref: branch, expectedCommit: commitSha }, authority },
-        execute: async () => {
-            await assertWorkspaceMatchesCandidate(root, boundCandidate, operation.candidateRevision);
-            const result = await runExecutable("git", ["push", "origin", `HEAD:${quoteRef(branch)}`], { cwd: root, timeoutMs: 180_000 });
-            return { outcome: result.exitCode === 0 ? "SUCCEEDED" : "FAILED", evidence: { ref: branch, exitCode: result.exitCode, stderr: result.stderr.slice(-2000) } };
-        },
-        reconcile: (intent) => reconcileToolAction(root, intent, { remote: "origin", ref: branch, expectedCommit: commitSha })
-    });
-    assertDeliveryGateProgress(pushGate, "git.push");
-    if (pushGate.receipt?.outcome === "FAILED")
-        throw new Error(`BLOCKED_EXTERNAL: git push failed for ${branch}: ${pushGate.detail}`);
-    if (github.pullRequests === false) {
-        return { status: "FINALIZED", humanRequired: false, committed, commitSha, pushed: true, candidate, message: `Accepted issue task finalized on ${branch} with a push-only delivery policy; pull request creation was not requested by frozen policy.` };
-    }
-    const token = resolveGithubToken(github.tokenEnv);
-    const apiBase = (github.apiBaseUrl ?? "https://api.github.com").replace(/\/$/, "");
-    const owner = repository.split("/")[0];
-    const query = `/repos/${repository}/pulls?state=open&head=${encodeURIComponent(`${owner}:${branch}`)}&base=${encodeURIComponent(base)}`;
-    const prPayload = { repository, head: branch, base, apiBase };
-    let pr;
-    const prGate = await executeGatedAction({
-        root,
-        request: { root, operationId, participantId: actor, candidate: boundCandidate, actionKey: `delivery:${contract.task.id}:pull-request`, action: "github.pull-request.create", payload: prPayload, authority },
-        execute: async () => {
-            await assertWorkspaceMatchesCandidate(root, boundCandidate, operation.candidateRevision);
-            const existing = await githubRequest(apiBase, token, query);
-            if (existing[0]) {
-                pr = existing[0];
-                return { outcome: "SUCCEEDED", evidence: { number: existing[0].number, url: existing[0].html_url, reused: true } };
-            }
-            const created = await githubRequest(apiBase, token, `/repos/${repository}/pulls`, {
-                method: "POST",
-                body: JSON.stringify({ title: `${contract.task.id}: ${contract.task.title}`, head: branch, base, draft: github.pullRequestDraft ?? true, body: buildPullRequestBody(contract) })
-            });
-            pr = created;
-            return { outcome: "SUCCEEDED", evidence: { number: created.number, url: created.html_url } };
-        },
-        reconcile: (intent) => reconcileToolAction(root, intent, prPayload, { token })
-    });
-    assertDeliveryGateProgress(prGate, "github.pull-request.create");
-    if (prGate.receipt?.outcome === "FAILED")
-        throw new Error(`BLOCKED_EXTERNAL: pull request creation failed: ${prGate.detail}`);
-    if (!pr) {
-        const existing = await githubRequest(apiBase, token, query);
-        pr = existing[0];
-    }
-    if (!pr)
-        throw new Error("BLOCKED_EXTERNAL: a pull request receipt exists but no open pull request could be observed.");
-    return { status: "FINALIZED", humanRequired: false, committed, commitSha, pushed: true, candidate, pullRequest: { number: pr.number, url: pr.html_url, draft: pr.draft ?? (github.pullRequestDraft ?? true) }, message: `Accepted issue task finalized on ${branch}; pull request #${pr.number}.` };
-}
-function assertDeliveryGateProgress(gate, action) {
-    if (gate.status === "HUMAN_REQUIRED" || gate.status === "RECONCILIATION_REQUIRED") {
-        throw new Error(`BLOCKED_EXTERNAL: ${action} has an unresolved durable intent and requires human reconciliation: ${gate.detail}`);
-    }
-}
-export function deliveryFinalizationFailure(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    const external = /^BLOCKED_EXTERNAL:/.test(message);
-    const supplyChain = /^SUPPLY_CHAIN_BLOCKED:/.test(message);
-    return { status: external ? "BLOCKED_EXTERNAL" : supplyChain ? "BLOCKED_SUPPLY_CHAIN" : "SYSTEM_FAILURE", humanRequired: external, committed: false, pushed: false, message };
-}
-function buildPullRequestBody(contract) { const issue = contract.issue; return `## Harness delivery\n\nTask: \`${contract.task.id}\`\nSource: ${issue.repository}#${issue.number}\nFrozen issue SHA-256: \`${issue.contentSha256}\`\n\nThe implementation passed the configured deterministic validation, quality convergence and lead-acceptance workflow before this PR was created.\n\nCloses #${issue.number}\n`; }
-function skipped(message, candidate) { return { status: "SKIPPED", humanRequired: false, committed: false, pushed: false, candidate, message }; }
-async function commitWithConfiguredOrHarnessIdentity(root, message) {
-    const name = await runExecutable("git", ["config", "user.name"], { cwd: root, timeoutMs: 10_000 });
-    const email = await runExecutable("git", ["config", "user.email"], { cwd: root, timeoutMs: 10_000 });
-    const args = [
-        ...(name.exitCode === 0 && name.stdout.trim() && email.exitCode === 0 && email.stdout.trim()
-            ? []
-            : ["-c", "user.name=Agentic Engineering Harness", "-c", "user.email=aeh@users.noreply.github.com"]),
-        "commit", "-m", message
-    ];
-    return runExecutable("git", args, { cwd: root, timeoutMs: 120_000 });
-}
-async function revParse(root, ref) {
-    const result = await runExecutable("git", ["rev-parse", "--verify", "--end-of-options", ref], { cwd: root, timeoutMs: 30_000 });
-    if (result.exitCode !== 0)
-        throw new Error(`SYSTEM_FAILURE: git rev-parse ${ref} failed: ${result.stderr || result.stdout}`);
-    return result.stdout.trim();
-}
-function quoteRef(value) { if (!/^[A-Za-z0-9._\/-]+$/.test(value) || value.startsWith("-") || value.startsWith("/") || value.endsWith("/") || value.endsWith(".") || value.includes("..") || value.includes("@{"))
-    throw new Error(`Unsafe git ref: ${value}`); return value; }
-//# sourceMappingURL=finalize.js.map

package/dist/releases/release-1790879524733-14883-031f8c92/delivery/finalize.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"finalize.js","sourceRoot":"","sources":["../../src/delivery/finalize.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAC3I,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAA4B,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAsC,MAAM,+BAA+B,CAAC;AACtG,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAerF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY,EAAE,MAA4B,EAAE,QAAsB,EAAE,UAA+C,EAAE;IAC/J,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,4BAA4B,EAAE,SAAS,CAAC,CAAC;IACrH,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,KAAK,KAAK,CAAC;IAC7E,MAAM,qBAAqB,GAAG,MAAM,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,qBAAqB,CAAC;QAAE,OAAO,OAAO,CAAC,oDAAoD,EAAE,SAAS,CAAC,CAAC;IAEvJ,MAAM,gBAAgB,GAAG,uBAAuB,EAAE,CAAC;IACnD,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,CAAC;IACxC,MAAM,eAAe,GAAG,8BAA8B,EAAE,CAAC;IACzD,IAAI,CAAC,WAAW,IAAI,eAAe,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oHAAoH,CAAC,CAAC;IACzL,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;IACpF,MAAM,cAAc,GAAG,SAAS,IAAI,SAAS,CAAC,iBAAiB,CAAC;IAChE,IAAI,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,cAAc,CAAC,cAAc,KAAK,SAAS,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC;QACpI,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,8BAA8B,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IACjG,MAAM,+BAA+B,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACzF,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,gBAAgB,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzH,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,gBAAgB;YACrB,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,QAAQ,CAAC,IAAI,CAAC,EAAE,uCAAuC,EAAE;YACvM,CAAC,CAAC,OAAO,CAAC,wDAAwD,EAAE,SAAS,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAkC,EAAE,IAAI,EAAE,sBAAsB,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAChH,MAAM,KAAK,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAE7C,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9I,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,IAAI,CAAC,EAAE,mDAAmD,CAAC,CAAC;IAC3I,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;IAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,iBAAiB,IAAI,QAAQ,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE,OAAO,IAAI,MAAM,CAAC;IAE9G,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACvG,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAChI,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,SAA6B,CAAC;IAElC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACpE,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,+BAA+B,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC;YAC1C,IAAI;YACJ,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE;YAChP,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxF,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC;oBAAE,OAAO,EAAE,OAAO,EAAE,QAAiB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBAClJ,IAAI,CAAC;oBAAC,MAAM,+BAA+B,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;gBAAC,CAAC;gBACjG,OAAO,KAAK,EAAE,CAAC;oBAAC,OAAO,EAAE,OAAO,EAAE,QAAiB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBAAC,CAAC;gBAC1H,MAAM,MAAM,GAAG,MAAM,qCAAqC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBAChF,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,WAAoB,CAAC,CAAC,CAAC,QAAiB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACpL,CAAC;YACD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;SAC/G,CAAC,CAAC;QACH,0BAA0B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3J,SAAS,GAAG,IAAI,CAAC;QACjB,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;;QAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEhD,MAAM,+BAA+B,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAEzF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,UAAU,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3H,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,kCAAkC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9J,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,0BAA0B,IAAI,gCAAgC,EAAE,CAAC;IAE7N,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC;QACxC,IAAI;QACJ,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE;QACrO,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,+BAA+B,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACzF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7H,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,WAAoB,CAAC,CAAC,CAAC,QAAiB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACjL,CAAC;QACD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;KACvH,CAAC,CAAC;IACH,0BAA0B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAEnI,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,oCAAoC,MAAM,8FAA8F,EAAE,CAAC;IACzP,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,UAAU,0BAA0B,kBAAkB,CAAC,GAAG,KAAK,IAAI,MAAM,EAAE,CAAC,SAAS,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;IACxI,MAAM,SAAS,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9D,IAAI,EAAiC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,IAAI;QACJ,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,4BAA4B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE;QAC5M,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,+BAA+B,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACzF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAsB,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACjF,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChB,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,WAAoB,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YAC9H,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAoB,OAAO,EAAE,KAAK,EAAE,UAAU,UAAU,QAAQ,EAAE;gBACnG,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;aACjL,CAAC,CAAC;YACH,EAAE,GAAG,OAAO,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,WAAoB,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;QACxG,CAAC;QACD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC;KAC/E,CAAC,CAAC;IACH,0BAA0B,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9H,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAsB,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACjF,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IAExH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,oCAAoC,MAAM,mBAAmB,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC;AACtS,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAyB,EAAE,MAAc;IAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,IAAI,IAAI,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,wEAAwE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpI,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChL,CAAC;AAAA,SAAS,oBAAoB,CAAC,QAAsB,IAAY,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAM,CAAC,CAAC,OAAO,kCAAkC,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,6BAA6B,KAAK,CAAC,aAAa,oKAAoK,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AAC/a,SAAS,OAAO,CAAC,OAAe,EAAE,SAA+B,IAAgC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC3M,KAAK,UAAU,qCAAqC,CAAC,IAAY,EAAE,OAAe;IAChF,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACrG,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;YAC1F,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,yCAAyC,CAAC,CAAC;QACrG,QAAQ,EAAE,IAAI,EAAE,OAAO;KACxB,CAAC;IACF,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AACD,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAW;IAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAChI,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,YAAY,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7H,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AACD,SAAS,QAAQ,CAAC,KAAa,IAAY,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;IAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC"}

package/dist/releases/release-1790879524733-14883-031f8c92/delivery/handoff.d.ts

@@ -1,41 +0,0 @@
-import type { HarnessProjectConfig, TaskContract } from "../core/types.js";
-export interface DeliveryRecord {
-    version: 1;
-    taskId: string;
-    status: "initialized" | "issue-created" | "branch-created" | "workspace-created" | "ready";
-    createdAt: string;
-    updatedAt: string;
-    originatingBranch: string;
-    github?: {
-        repository: string;
-        issueNumber?: number;
-        issueUrl?: string;
-        branch?: string;
-        branchSha?: string;
-    };
-    paseo?: {
-        workspaceId?: string;
-        worktreePath?: string;
-    };
-}
-export declare function handoffTask(root: string, config: HarnessProjectConfig, taskId: string, options?: {
-    createWorkspace?: boolean;
-}): Promise<DeliveryRecord>;
-export declare function handoffSdd(root: string, config: HarnessProjectConfig, taskId: string): Promise<DeliveryRecord>;
-export declare function seedDeliveryRecordFromIssue(root: string, config: HarnessProjectConfig, contract: TaskContract, issue: {
-    repository: string;
-    issueNumber: number;
-    issueUrl: string;
-}): Promise<DeliveryRecord>;
-export declare function assertHandoffReady(root: string, contract: TaskContract): Promise<void>;
-export declare function materializeTaskContext(controlRoot: string, workspaceRoot: string, config: HarnessProjectConfig, contract: TaskContract): Promise<void>;
-export declare function loadDeliveryRecord(root: string, config: HarnessProjectConfig, taskId: string): Promise<DeliveryRecord | undefined>;
-export declare function deliveryWorkspaceId(root: string, config: HarnessProjectConfig, taskId: string): Promise<string | undefined>;
-export declare function deliveryWorkspacePath(root: string, config: HarnessProjectConfig, taskId: string): Promise<string | undefined>;
-export declare function parseGithubRepository(remote: string): string | undefined;
-export declare function renderPattern(pattern: string, contract: TaskContract, issue?: number): string;
-export declare function renderIssueBody(root: string, contract: TaskContract, originatingBranch: string): Promise<string>;
-export declare function inferGithubRepository(root: string): Promise<string>;
-export declare function resolveGithubTokenOptional(preferred?: string): string | undefined;
-export declare function resolveGithubToken(preferred?: string): string;
-export declare function githubRequest<T = unknown>(base: string, token: string | undefined, endpoint: string, init?: RequestInit): Promise<T>;

package/dist/releases/release-1790879524733-14883-031f8c92/delivery/handoff.js

@@ -1,356 +0,0 @@
-import fs from "node:fs/promises";
-import path from "node:path";
-import { getOriginRemote } from "../core/git.js";
-import { loadTaskContract } from "../core/config.js";
-import { validateSddChange } from "../core/sdd.js";
-import { verifyTaskSeal } from "../core/seal.js";
-import { runExecutable } from "../utils/process.js";
-import { assertWorkspaceMatchesCandidate } from "../candidates/identity.js";
-import { requireAcceptedCurrentOracleV1 } from "../architecture/acceptanceOracle.js";
-import { verifySupplyChainGate } from "../provenance/generate.js";
-import { currentOperationContext, controllerEpochFromEnvironment, loadOperation, resolveOperationStateRoot } from "../operations/state.js";
-import { controllerActorId } from "../security/toolActionGate.js";
-import { executeGatedAction } from "../security/gatedAction.js";
-import { reconcileToolAction } from "../security/actionReconciliation.js";
-export async function handoffTask(root, config, taskId, options = {}) {
-    const contract = await loadTaskContract(root, taskId, config);
-    if (contract.routing?.route === "FORMAL_SDD") {
-        const validation = await validateSddChange(root, taskId, config);
-        if (!validation.ok)
-            throw new Error(`Cannot hand off ${taskId}: SDD validation failed: ${[...validation.missing, ...validation.issues].join("; ")}`);
-    }
-    await assertHandoffReady(root, contract);
-    if (config.validation?.requireSeal !== false) {
-        const seal = await verifyTaskSeal(root, contract, true);
-        if (seal.status !== "PASS")
-            throw new Error(`Cannot hand off ${taskId}: ${seal.message}`);
-    }
-    const originatingBranch = contract.git?.originatingBranch ?? contract.git?.baseRef ?? config.validation?.baseRef ?? "main";
-    let record = await loadDeliveryRecord(root, config, taskId) ?? { version: 1, taskId, status: "initialized", createdAt: new Date().toISOString(), updatedAt: new Date().toISOString(), originatingBranch };
-    const github = config.delivery?.github;
-    const paseo = config.delivery?.paseo;
-    if (record.paseo?.worktreePath && !(await exists(record.paseo.worktreePath)))
-        record.paseo = undefined;
-    const needsIssue = github?.enabled === true && !record.github?.issueNumber;
-    const needsBranch = github?.enabled === true && !record.github?.branch;
-    const needsWorkspace = options.createWorkspace !== false && paseo?.enabled === true && paseo.createWorkspace !== false && !record.paseo?.workspaceId;
-    const handoffAuthority = needsIssue || needsBranch || needsWorkspace ? await requireHandoffAuthority(root, config, taskId) : undefined;
-    if (github?.enabled) {
-        const token = resolveGithubToken(github.tokenEnv);
-        const repository = record.github?.repository ?? github.repository ?? await inferGithubRepository(root);
-        const apiBase = (github.apiBaseUrl ?? "https://api.github.com").replace(/\/$/, "");
-        record.github = { repository, ...(record.github ?? {}) };
-        await saveDeliveryRecord(root, config, record);
-        if (!record.github.issueNumber) {
-            const marker = handoffIssueMarker(handoffAuthority.operationId, taskId);
-            const body = `${await renderIssueBody(root, contract, originatingBranch)}\n\n${marker}`;
-            const assignees = [];
-            if (github.assignTokenOwner !== false)
-                assignees.push((await githubRequest(apiBase, token, "/user")).login);
-            const issuePayload = { repository, marker, apiBase, title: `${contract.task.id}: ${contract.task.title}`, body, labels: github.labels ?? [], assignees };
-            let issue;
-            const gate = await executeGatedAction({
-                root,
-                request: handoffActionRequest(root, handoffAuthority, `handoff:${taskId}:github-issue`, "github.issue.create", issuePayload),
-                execute: async () => { issue = await githubRequest(apiBase, token, `/repos/${repository}/issues`, { method: "POST", body: JSON.stringify({ title: issuePayload.title, body, labels: issuePayload.labels, assignees }) }); return { outcome: "SUCCEEDED", evidence: { issueNumber: issue.number, issueUrl: issue.html_url, marker } }; },
-                reconcile: (intent) => reconcileToolAction(root, intent, issuePayload, { token })
-            });
-            assertHandoffActionSucceeded(gate, "github.issue.create");
-            issue ??= await findGithubIssueByMarker(apiBase, token, repository, marker);
-            if (!issue)
-                throw new Error(`HANDOFF_RECONCILIATION_REQUIRED: issue receipt for ${taskId} is durable, but the issue identity could not be recovered from marker ${marker}.`);
-            record.github.issueNumber = issue.number;
-            record.github.issueUrl = issue.html_url;
-            record.status = "issue-created";
-            record.updatedAt = new Date().toISOString();
-            await saveDeliveryRecord(root, config, record);
-        }
-        if (!record.github.branch) {
-            const branch = renderPattern(github.branchPattern ?? "feature/gh-{issue}-{slug}", contract, record.github.issueNumber);
-            const existing = await githubRequestMaybe(apiBase, token, `/repos/${repository}/git/ref/heads/${encodeRef(branch)}`);
-            if (existing) {
-                record.github.branch = branch;
-                record.github.branchSha = existing.object.sha;
-            }
-            else {
-                const baseRef = await githubRequest(apiBase, token, `/repos/${repository}/git/ref/heads/${encodeRef(originatingBranch)}`);
-                const branchPayload = { repository, branch, sha: baseRef.object.sha, apiBase };
-                const gate = await executeGatedAction({
-                    root,
-                    request: handoffActionRequest(root, handoffAuthority, `handoff:${taskId}:github-branch`, "github.branch.create", branchPayload),
-                    execute: async () => { await githubRequest(apiBase, token, `/repos/${repository}/git/refs`, { method: "POST", body: JSON.stringify({ ref: `refs/heads/${branch}`, sha: baseRef.object.sha }) }); return { outcome: "SUCCEEDED", evidence: { repository, branch, sha: baseRef.object.sha } }; },
-                    reconcile: (intent) => reconcileToolAction(root, intent, branchPayload, { token })
-                });
-                assertHandoffActionSucceeded(gate, "github.branch.create");
-                record.github.branch = branch;
-                record.github.branchSha = baseRef.object.sha;
-            }
-            record.status = "branch-created";
-            record.updatedAt = new Date().toISOString();
-            await saveDeliveryRecord(root, config, record);
-        }
-    }
-    if (options.createWorkspace !== false && paseo?.enabled && paseo.createWorkspace !== false) {
-        if (!record.paseo?.workspaceId) {
-            const issue = record.github?.issueNumber;
-            const slug = renderPattern(paseo.worktreeSlugPattern ?? "gh-{issue}-{slug}", contract, issue);
-            const remoteBranch = record.github?.branch;
-            const localIssueBranch = issue ? renderPattern(github?.branchPattern ?? "feature/gh-{issue}-{slug}", contract, issue) : renderPattern("aeh-{task}-{slug}", contract, issue);
-            const workspacePayload = { path: root, isolation: "worktree", mode: remoteBranch ? "checkout-branch" : "branch-off", branch: remoteBranch ?? localIssueBranch, base: remoteBranch ? undefined : originatingBranch, slug, title: taskId };
-            let workspace;
-            const gate = await executeGatedAction({
-                root,
-                request: handoffActionRequest(root, handoffAuthority, `handoff:${taskId}:paseo-workspace`, "paseo.workspace.create", workspacePayload),
-                execute: async () => {
-                    workspace = remoteBranch
-                        ? await createCheckoutWorkspace(root, remoteBranch, slug, taskId, handoffAuthority, record.github?.branchSha)
-                        : await createBranchOffWorkspace(root, originatingBranch, localIssueBranch, slug, taskId);
-                    return { outcome: "SUCCEEDED", evidence: { workspaceId: workspace.workspaceId, worktreePath: workspace.worktreePath, branch: workspacePayload.branch } };
-                },
-                reconcile: (intent) => reconcileToolAction(root, intent, { ...workspacePayload, ...(record.paseo?.workspaceId ? { workspaceId: record.paseo.workspaceId } : {}) })
-            });
-            assertHandoffActionSucceeded(gate, "paseo.workspace.create");
-            if (!workspace?.worktreePath)
-                throw new Error("HANDOFF_RECONCILIATION_REQUIRED: workspace action has a receipt but its path is not durably recoverable; human inspection is required.");
-            await materializeTaskContext(root, workspace.worktreePath, config, contract);
-            record.paseo = workspace;
-            record.status = "workspace-created";
-            record.updatedAt = new Date().toISOString();
-            await saveDeliveryRecord(root, config, record);
-        }
-        else if (record.paseo.worktreePath)
-            await materializeTaskContext(root, record.paseo.worktreePath, config, contract);
-    }
-    record.status = "ready";
-    record.updatedAt = new Date().toISOString();
-    await saveDeliveryRecord(root, config, record);
-    return record;
-}
-export async function handoffSdd(root, config, taskId) { return handoffTask(root, config, taskId); }
-export async function seedDeliveryRecordFromIssue(root, config, contract, issue) {
-    const originatingBranch = contract.git?.originatingBranch ?? contract.git?.baseRef ?? config.validation?.baseRef ?? "main";
-    const existing = await loadDeliveryRecord(root, config, contract.task.id);
-    if (existing?.github?.issueNumber && existing.github.issueNumber !== issue.issueNumber)
-        throw new Error(`Delivery record ${contract.task.id} is already bound to GitHub issue #${existing.github.issueNumber}.`);
-    if (existing?.github?.repository && existing.github.repository !== issue.repository)
-        throw new Error(`Delivery record ${contract.task.id} is already bound to ${existing.github.repository}.`);
-    const now = new Date().toISOString();
-    const record = existing ?? { version: 1, taskId: contract.task.id, status: "initialized", createdAt: now, updatedAt: now, originatingBranch };
-    record.github = { repository: issue.repository, issueNumber: issue.issueNumber, issueUrl: issue.issueUrl, ...(record.github ?? {}) };
-    if (record.status === "initialized")
-        record.status = "issue-created";
-    record.updatedAt = now;
-    await saveDeliveryRecord(root, config, record);
-    return record;
-}
-export async function assertHandoffReady(root, contract) {
-    const placeholders = [];
-    for (const kind of ["proposal", "spec", "design", "tasks", "acceptance"]) {
-        const relative = contract.source?.[kind];
-        if (!relative)
-            continue;
-        const content = await fs.readFile(path.resolve(root, relative), "utf8");
-        if (/\bTODO\b|TODO observable|TODO business rule/i.test(content))
-            placeholders.push(kind);
-    }
-    for (const requirement of contract.requirements ?? [])
-        if (/\bTODO\b/i.test(requirement.description ?? ""))
-            placeholders.push(`requirement:${requirement.id}`);
-    if (placeholders.length)
-        throw new Error(`Cannot hand off ${contract.task.id}: unresolved template placeholders remain in ${[...new Set(placeholders)].join(", ")}.`);
-}
-export async function materializeTaskContext(controlRoot, workspaceRoot, config, contract) {
-    if (path.resolve(controlRoot) === path.resolve(workspaceRoot))
-        return;
-    const relativeFiles = [...Object.values(contract.source ?? {}).filter((value) => Boolean(value)), path.join(config.sdd?.contractsDir ?? ".harness/contracts", `${contract.task.id}.yaml`), path.join(".harness", "seals", `${contract.task.id}.json`)];
-    for (const relative of [...new Set(relativeFiles)]) {
-        if (path.isAbsolute(relative) || relative.startsWith(".."))
-            throw new Error(`Task context path must be repository-relative for worktree handoff: ${relative}`);
-        const source = path.resolve(controlRoot, relative);
-        const destination = path.resolve(workspaceRoot, relative);
-        try {
-            await fs.access(source);
-        }
-        catch {
-            throw new Error(`Task context artifact is missing before worktree handoff: ${relative}`);
-        }
-        await fs.mkdir(path.dirname(destination), { recursive: true });
-        await fs.copyFile(source, destination);
-    }
-}
-export async function loadDeliveryRecord(root, config, taskId) {
-    const candidates = [path.resolve(resolveOperationStateRoot(root)), ...(await deliveryControlRoots(root))];
-    for (const candidate of [...new Set(candidates)]) {
-        try {
-            return JSON.parse(await fs.readFile(deliveryFile(candidate, config, taskId), "utf8"));
-        }
-        catch { /* try next root */ }
-    }
-    return undefined;
-}
-export async function deliveryWorkspaceId(root, config, taskId) { if (config.delivery?.paseo?.enabled !== true || config.delivery.paseo.autoUseWorkspace === false)
-    return undefined; return (await loadDeliveryRecord(root, config, taskId))?.paseo?.workspaceId; }
-export async function deliveryWorkspacePath(root, config, taskId) { if (config.delivery?.paseo?.enabled !== true || config.delivery.paseo.autoUseWorkspace === false)
-    return undefined; const value = (await loadDeliveryRecord(root, config, taskId))?.paseo?.worktreePath; return value && await exists(value) ? value : undefined; }
-export function parseGithubRepository(remote) { const ssh = remote.match(/^[^@]+@[^:]+:([^/]+\/[^/]+?)(?:\.git)?$/); if (ssh)
-    return ssh[1]; try {
-    const url = new URL(remote);
-    const value = url.pathname.replace(/^\//, "").replace(/\.git$/, "");
-    return /^[^/]+\/[^/]+$/.test(value) ? value : undefined;
-}
-catch {
-    return undefined;
-} }
-export function renderPattern(pattern, contract, issue) { const slug = slugify(contract.task.title); return pattern.replaceAll("{issue}", issue ? String(issue) : "no-issue").replaceAll("{task}", slugify(contract.task.id)).replaceAll("{slug}", slug); }
-export async function renderIssueBody(root, contract, originatingBranch) { const spec = contract.source?.spec ? await fs.readFile(path.resolve(root, contract.source.spec), "utf8") : ""; const acceptance = contract.source?.acceptance ? await fs.readFile(path.resolve(root, contract.source.acceptance), "utf8") : ""; const requirements = (contract.requirements ?? []).map((item) => `- ${item.id}: ${item.description ?? "see specification"}`).join("\n"); return `**Source: Agentic Engineering Harness SDD**\n\n**Task:** ${contract.task.id}\n\n## Implementation Start Rule\nImplementation is authorized from this issue-linked branch only after the validated SDD handoff completes. The local sealed TaskContract and SDD artifacts remain normative; this issue is a delivery mirror.\n\n## Originating Branch\n${originatingBranch}\n\n## Requirements\n${requirements || "See specification."}\n\n## Specification\n${spec.trim()}\n\n## Acceptance\n\`\`\`gherkin\n${acceptance.trim()}\n\`\`\`\n\n## Harness Sources\n${Object.entries(contract.source ?? {}).map(([name, value]) => `- ${name}: \`${value}\``).join("\n")}\n`; }
-export async function inferGithubRepository(root) { const remote = await getOriginRemote(root); const repository = remote ? parseGithubRepository(remote) : undefined; if (!repository)
-    throw new Error("Cannot infer GitHub repository from origin; set delivery.github.repository as owner/repo."); return repository; }
-export function resolveGithubTokenOptional(preferred) { for (const name of [preferred, "GH_TOKEN", "GITHUB_TOKEN", "GITHUB_PAT"].filter((value) => Boolean(value))) {
-    const token = process.env[name];
-    if (token)
-        return token;
-} return undefined; }
-export function resolveGithubToken(preferred) { const token = resolveGithubTokenOptional(preferred); if (token)
-    return token; throw new Error(`GitHub delivery is enabled but no token is available. Set ${preferred ?? "GH_TOKEN"} (or GITHUB_TOKEN/GITHUB_PAT).`); }
-export async function githubRequest(base, token, endpoint, init = {}) {
-    const headers = new Headers(init.headers);
-    headers.set("Accept", "application/vnd.github+json");
-    headers.set("X-GitHub-Api-Version", "2022-11-28");
-    headers.set("Content-Type", "application/json");
-    if (token)
-        headers.set("Authorization", `Bearer ${token}`);
-    const response = await fetch(`${base}${endpoint}`, { ...init, headers });
-    const text = await response.text();
-    if (!response.ok)
-        throw new Error(`GitHub API ${init.method ?? "GET"} ${endpoint} failed (${response.status}): ${text.slice(0, 1000)}`);
-    return text ? JSON.parse(text) : undefined;
-}
-async function githubRequestMaybe(base, token, endpoint) { try {
-    return await githubRequest(base, token, endpoint);
-}
-catch (error) {
-    if (/failed \(404\)/.test(String(error)))
-        return undefined;
-    throw error;
-} }
-async function createCheckoutWorkspace(root, branch, slug, title, authority, expectedCommit) {
-    assertGitBranchName(branch);
-    if (!expectedCommit || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(expectedCommit))
-        throw new Error(`HANDOFF_CANDIDATE_REQUIRED: GitHub branch ${branch} is missing an exact observed commit SHA.`);
-    const local = await runExecutable("git", ["show-ref", "--verify", "--hash", `refs/heads/${branch}`], { cwd: root });
-    if (local.exitCode === 0) {
-        if (local.stdout.trim().toLowerCase() !== expectedCommit.toLowerCase())
-            throw new Error(`HANDOFF_BRANCH_CONFLICT: local branch ${branch} does not match the observed GitHub branch commit.`);
-    }
-    else if (local.exitCode === 1) {
-        const payload = { branch, expectedCommit };
-        const gate = await executeGatedAction({
-            root,
-            request: handoffActionRequest(root, authority, `handoff:${authority.candidate.taskId}:local-branch`, "git.branch.create", payload),
-            execute: async () => {
-                const refspec = `refs/heads/${branch}:refs/heads/${branch}`;
-                const fetchResult = await runExecutable("git", ["fetch", "origin", refspec], { cwd: root, timeoutMs: 120_000 });
-                if (fetchResult.exitCode !== 0)
-                    return { outcome: "FAILED", evidence: { branch, expectedCommit, exitCode: fetchResult.exitCode, stderr: fetchResult.stderr.slice(-2000) } };
-                const observed = await runExecutable("git", ["show-ref", "--verify", "--hash", `refs/heads/${branch}`], { cwd: root });
-                const observedCommit = observed.stdout.trim().toLowerCase();
-                const outcome = observed.exitCode === 0 && observedCommit === expectedCommit.toLowerCase() ? "SUCCEEDED" : "FAILED";
-                return { outcome, evidence: { branch, expectedCommit: expectedCommit.toLowerCase(), observedCommit: observedCommit || undefined, exitCode: observed.exitCode } };
-            },
-            reconcile: (intent) => reconcileToolAction(root, intent, payload)
-        });
-        assertHandoffActionSucceeded(gate, "git.branch.create");
-        const verified = await runExecutable("git", ["show-ref", "--verify", "--hash", `refs/heads/${branch}`], { cwd: root });
-        if (verified.exitCode !== 0 || verified.stdout.trim().toLowerCase() !== expectedCommit.toLowerCase())
-            throw new Error(`HANDOFF_BRANCH_RECONCILIATION_REQUIRED: gated branch creation for ${branch} has no matching local ref.`);
-    }
-    else {
-        throw new Error(`HANDOFF_BRANCH_INSPECTION_FAILED: could not inspect local branch ${branch}: ${local.stderr || local.stdout}`);
-    }
-    return runPaseoWorkspace(root, ["--mode", "checkout-branch", "--branch", branch], slug, title, branch);
-}
-async function createBranchOffWorkspace(root, base, branch, slug, title) {
-    assertGitBranchName(branch);
-    assertGitBranchName(base);
-    return runPaseoWorkspace(root, ["--mode", "branch-off", "--new-branch", branch, "--base", base], slug, title, branch);
-}
-async function requireHandoffAuthority(root, config, taskId) {
-    const context = currentOperationContext();
-    const controllerEpoch = controllerEpochFromEnvironment();
-    if (!context.id || controllerEpoch === undefined)
-        throw new Error("HANDOFF_AUTHORITY_REQUIRED: delivery handoff mutations require a managed operation and fenced controller.");
-    const operation = await loadOperation(resolveOperationStateRoot(root), context.id);
-    const candidate = operation.candidateRevision;
-    if (!candidate || candidate.taskId !== taskId)
-        throw new Error("HANDOFF_AUTHORITY_REQUIRED: delivery handoff requires the operation's current CandidateRevision for this task.");
-    await requireAcceptedCurrentOracleV1(resolveOperationStateRoot(root), operation, candidate);
-    const supplyChain = await verifySupplyChainGate(root, config, { candidate, artifactPath: config.provenance?.artifact ?? "" });
-    if (!supplyChain.ok)
-        throw new Error(`SUPPLY_CHAIN_BLOCKED: ${supplyChain.failures.join("; ")}`);
-    await assertWorkspaceMatchesCandidate(root, candidate, operation.candidateRevision);
-    return { operationId: context.id, controllerEpoch, candidate, evidence: { kind: "controller-authority", operationId: context.id, controllerEpoch } };
-}
-function handoffActionRequest(root, authority, actionKey, action, payload) {
-    return { root, operationId: authority.operationId, participantId: controllerActorId(authority.operationId), candidate: authority.candidate, actionKey, action, payload, authority: authority.evidence };
-}
-function assertHandoffActionSucceeded(gate, action) {
-    if (["HUMAN_REQUIRED", "RECONCILIATION_REQUIRED"].includes(gate.status))
-        throw new Error(`HANDOFF_RECONCILIATION_REQUIRED: ${action} requires resolution before retry: ${gate.detail}`);
-    if (gate.receipt?.outcome !== "SUCCEEDED")
-        throw new Error(`HANDOFF_ACTION_FAILED: ${action} did not complete: ${gate.detail}`);
-}
-function handoffIssueMarker(operationId, taskId) { return `<!-- aeh-handoff:${operationId}:${taskId} -->`; }
-async function findGithubIssueByMarker(apiBase, token, repository, marker) {
-    const issues = await githubRequest(`${apiBase}`, token, `/repos/${repository}/issues?state=all&per_page=100`);
-    return issues.find((issue) => issue.body?.includes(marker));
-}
-async function runPaseoWorkspace(root, mode, slug, title, branch) {
-    const create = await runExecutable("paseo", ["workspace", "create", "--isolation", "worktree", "--path", root, ...mode, "--worktree-slug", slug, "--title", title, "--json"], { cwd: root, timeoutMs: 180_000 });
-    if (create.exitCode !== 0)
-        throw new Error(`Paseo workspace creation failed: ${create.stderr || create.stdout}`);
-    const direct = parseWorkspace(create.stdout, branch);
-    if (direct.workspaceId && direct.worktreePath)
-        return direct;
-    const list = await runExecutable("paseo", ["workspace", "ls", "--json"], { cwd: root, timeoutMs: 60_000 });
-    if (list.exitCode === 0) {
-        const found = parseWorkspace(list.stdout, branch);
-        if (found.workspaceId && found.worktreePath)
-            return found;
-    }
-    throw new Error(`Paseo created the workspace but its ID/path could not be resolved. Output: ${create.stdout}`);
-}
-function parseWorkspace(raw, branch) { try {
-    const value = JSON.parse(raw);
-    const candidates = flattenObjects(value);
-    const found = candidates.find((item) => [item.branch, item.branchName, item.gitBranch].some((candidate) => candidate === branch)) ?? candidates.find((item) => typeof item.id === "string" || typeof item.workspaceId === "string");
-    return found ? { workspaceId: stringValue(found.workspaceId) ?? stringValue(found.id), worktreePath: stringValue(found.worktreePath) ?? stringValue(found.path) ?? stringValue(found.root) } : {};
-}
-catch {
-    return {};
-} }
-function flattenObjects(value) { if (Array.isArray(value))
-    return value.flatMap(flattenObjects); if (!value || typeof value !== "object")
-    return []; const record = value; return [record, ...Object.values(record).flatMap(flattenObjects)]; }
-function stringValue(value) { return typeof value === "string" && value ? value : undefined; }
-async function saveDeliveryRecord(root, config, record) { const file = deliveryFile(resolveOperationStateRoot(root), config, record.taskId); await fs.mkdir(path.dirname(file), { recursive: true }); await fs.writeFile(file, `${JSON.stringify(record, null, 2)}\n`); }
-async function deliveryControlRoots(root) { const roots = [path.resolve(root)]; const common = await runExecutable("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: root, timeoutMs: 10_000 }); if (common.exitCode === 0) {
-    const gitDir = common.stdout.trim();
-    if (path.basename(gitDir) === ".git")
-        roots.push(path.dirname(gitDir));
-} return [...new Set(roots)]; }
-function deliveryFile(root, config, taskId) { return path.join(root, config.delivery?.stateDir ?? ".harness/delivery", `${taskId}.json`); }
-function encodeRef(value) { return value.split("/").map(encodeURIComponent).join("/"); }
-function slugify(value) { return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "change"; }
-function assertGitBranchName(value) {
-    if (!value || value.startsWith("-") || value.startsWith("/") || value.endsWith("/") || value.includes("..") || value.includes("@{") || /[\x00-\x20~^:?*\\[]/.test(value) || value.includes("\\")) {
-        throw new Error(`Invalid Git branch name: ${value}`);
-    }
-}
-async function exists(file) { try {
-    await fs.access(file);
-    return true;
-}
-catch {
-    return false;
-} }
-//# sourceMappingURL=handoff.js.map